4 ms·
If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and da
by rkagerer 7y ago
If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting.
That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans will be human.
- sxates 7y agoThe best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...
- dingo_bat 7y agoNetflix is needlessly hard on TV. Hotstar has an amazing system where it shows a 4 letter code. You open the website on your laptop or phone and enter the code. No typing in TV.
- LeonB 7y agoSigning into some new tvs recently, the google account sign in experience was better than Netflix sign in, as it let you use your phone to sign in (once you’d scanned a QR code shown on screen).
- war1025 7y agoI generate my passwords with: $ head -c 100 /dev/urandom | sha256sum Same pain as you any time I have to type the password in someplace I don't have my password manager installed, but with the advantage that its just [0-9a-f]. I figure with that many characters there's no need to use the full character set. Also honestly just tend to use weaker passwords on things I'll need to log into on other machines. Usually those are accounts I don't care as much about anyway.
- function_seven 7y agoThis is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically. I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.
- dev_dull 7y agoThis is so nice!
- testvox 7y agoChromecast doesn't have its own UI or authentication, it just uses the authentication of the device the stream was started from (being able to delegate that is a requirement for chromecast support). So it solves the same issue but in a very different way. Its a pretty clever solution but requiring all interaction with your tv to happen through another computing device can get annoying.
- jimmaswell 7y agoDoes Netflix show your full card number to you if you're logged in or is there some other justification for this level of security on it?
- roganartu 7y agoYou need to login because accounts have different quality tiers (standard vs high definition) and different max concurrent user counts. Hulu does this much better though. They display a hulu.com shortlink on the TV app that you type into your browser on a computer, login if you aren't already, and click a button to authorise the TV.
- jimmaswell 7y agoI know you need to log in, I meant to ask what necessitated such an overkill password for a mere Netflix account.
- TimTheTinker 7y ago1Password lets you use dictionary words separated by spaces when generating random passwords. This can be really helpful on iOS/tvOS devices -- just use speech-to-text to type them in (not to mention being easier to remember).
- johndough 7y agoWith the recent controversy about Amazon and Google snooping in on smart speaker recordings, people should probably avoid reading out their passwords to human listeners.
- ScottFree 7y agoHow would they determine that a particular string of words was a password as opposed to any other sentence?
- Qwertystop 7y agoIf it's not a coherent sentence, that would tend to be a hint. There are other explanations, admittedly.
- ScottFree 7y agoBut how is a machine supposed to be able to tell the difference? It's hard enough for humans to tell the difference between industry-specific jargon and nonsense.
- TimTheTinker 7y agoI wouldn’t use Siri or Google Assistant, since those are recorded (and I’d feel uncomfortable using a Google speech-to-text feature for that anyway). But is Apple’s speech-to-text feature (like on the iOS keyboard or in tvOS) recorded? If not, I’d venture to say I’m (currently) OK doing that with Apple services. They’ve prioritized security and privacy admirably.
- tempestn 7y agoFrom that and lines like this one, I'm guessing the author does not use a password manager: > use more than 8 characters, or use a password manager if you are really nervous Also the article mentions that pw managers will get you long passwords, which will protect against brute force, but doesn't really mention the more significant benefit, that they protect against password reuse. Not to mention they're far more convenient than trying to remember strong passwords. So don't use a PW manager only if you're really nervous. Just use one, full stop. (But yeah, set password length at something like 13-14 characters. More than that doesn't provide any real world benefit, and there will occasionally be cases where you have to type it in. Plus you'll hit fewer snags with poorly designed systems enforcing max pw length.)
- josteink 7y ago> So don't use a PW manager only if you're really nervous. Just use one, full stop. And all modern browsers ship with one included, so it’s not like it’s hard to get started.
- richardw 7y agoI use more and reduce on the sites that make me type it in. Eg Netflix on smart TV. I don't want to spend time outrunning password guessing tech. QR codes, Samsung.
- deleted 7y ago[deleted]
- galkk 7y agoTotally agree. VUDU app on my smart tv required me to log on every couple months, and I stopped using it eventually.
- dev_dull 7y agoWhen this happens I thank my lucky stars that Mac/iOS supports iCloud copy/paste. Copy on one device and paste on the other.
- slaymaker1907 7y agoThat’s why when I made my password generator/manager I included the option to generate translate the entropy into various forms including just alphanumeric and english words. https://slaymaker1907.github.io/password/ https://slaymaker1907.github.io/password/ Not sure how common of a feature that is with most password managers, but I find it incredibly useful. For reference in case anyone wants to use it, my generator works by running scrypt on a master password as well some identifier for the site.